Quality Assurance
Procedure: Rights of Individuals
Procedure Ref: OP/7CA/SP113
Approved By: Principal
Date: May 2018
Signature:
TABLE OF CONTENTS
1.OVERVIEW
2.ABOUT THIS PROCEDURE?
3.SCOPE
4.DEFINITIONS
5.HOW DO WE ALLOW INDIVIDUALS TO EXERCISE THEIR RIGHTS UNDER DATA PROTECTION LAWS?
1.OVERVIEW
The College’s reputation and future growth are dependent on the way the College manages and protects Personal Data. All individuals have rights over their Personal Data. This Rights of Individuals Procedure must be read in conjunction with the College’s Rights of Individuals Policy. It explains the process the College follows to comply with its legal obligations to allow individuals to exercise their rights over their Personal Data which are detailed in the Rights of Individuals Policy.
College Personnel will receive a copy of this Policy when they start and may receive periodic revisions of this Policy. This Policy does not form part of any College Personnel’s contract of employment and the College reserves the right to change this Policy at any time. All College Personnel are obliged to comply with this Policy at all times.
2.ABOUT THIS PROCEDURE
The College’s Data Protection Policy is the College’s fundamental policy which sets out the types of Personal Data that the College may be required to handle, as well as the College’s legal purposes for doing so, and it sets out how the College complies with its obligations under Data Protection Laws.
This Procedure explains the process the College has in place to ensure that the College complies with its legal obligations to allow individuals to exercise their rights over their Personal Data. The College has a corresponding Rights of Individuals Policy that sets out what those rights are and explains College Personnel’s’ obligations in relation to ensuring that the College meets its obligations in this area.
3.SCOPE
This Procedure applies to all College Personnel who collect and/or use Personal Data relating to individuals.
It applies to all Personal Data stored electronically, in paper form, or otherwise.
4.DEFINITIONS
4.1.College – Lakes College West Cumbria.
4.2.College Personnel – Any College employee or contractor who has been authorised to access any of the College’s Personal Data and will include employees, consultants, contractors, and temporary personnel hired to work on behalf of the College.
4.3.Data Protection Laws – The General Data Protection Regulation (Regulation (EU) 2016/679) and all applicable laws relating to the collection and use of Personal Data and privacy and any applicable codes of practice issued by a regulator including in the UK, the Data Protection Act 2018.
4.4.Data Protection Officer – The Data Protection Officer is Karen Wilson, and can be contacted at: 01946 839300 ext 1010, .
4.5.ICO – the Information Commissioner’s Office, the UK’s data protection regulator.
4.6.Personal Data – any information about an individual which identifies them or allows them to be identified in conjunction with other information that is held. Personal data is defined very broadly and covers both ordinary personal data from personal contact details and business contact details to special categories of personal data such as trade union membership, genetic data and religious beliefs. It also covers information that allows an individual to be identified indirectly for example an identification number, location data or an online identifier.
4.7.Special Categories of Personal Data - Personal Data that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data (i.e. information about their inherited or acquired genetic characteristics), biometric data (i.e. information about their physical, physiological or behavioural characteristics such as facial images and fingerprints), physical or mental health, sexual life or sexual orientation and criminal record.
5.HOW DO WE ALLOW INDIVIDUALS TO EXERCISE THEIR RIGHTS UNDER DATA PROTECTION LAWS?
5.1.Right of access (subject access requests)
5.1.1.If a member of the College Personnel receives a request from an individual to access or to receive a copy of their Personal Data, the following procedure will be followed:
5.1.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it. A request from an individual does not have to be in a particular format, for example it does not have to be in writing. If the request is not made in writing (e.g. it is taken over the telephone) best practice is that the College asks the individual to confirm in writing so it can ensure it is complying correctly with the request. If they do not wish to do this, then please confirm the request in writing and ask them to indicate if there are any inaccuracies. Please note that the College can no longer charge a fee for responding to these requests unless a second or subsequent copy of the Personal Data is requested (in which case the College can charge its administrative costs) or the request is unfounded or excessive (see paragraph 5.8 below);
5.1.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.1.1.3.within 3 working days of receipt, the Data Protection Officer will decide whether any further information is needed from the individual to clarify the identity of the individual or to understand the request and will ask the individual for any further information that is needed as soon as possible;
5.1.1.4.if further information is required, no action will be taken until the further information has been received from the individual;
5.1.1.5.once the further information has been received and/or the College is satisfied that it knows what has been asked for, the College will begin locating the individual’s Personal Data;
5.1.1.6.depending on who the individual is, this may involve locating staff files, student files, information on parents, notes, minutes, correspondence and other relevant documents containing Personal Data either on the College’s information systems, or in the College’s structured paper filing systems. The Data Protection Officer will let College Personnel know what searches they need to carry out;
5.1.1.7.once the College has located all the Personal Data of the individual, the Data Protection Officer will review it and decide whether any of the Personal Data does not need to be disclosed as there are exemptions which may apply;
5.1.1.8.once the College has decided what the College is going to provide to the individual, the College will respond providing copies of the Personal Data, which, if the request is made electronically, shall be provided in a commonly used electronic form; and
5.1.1.9.if the College fails to do this within one month of the date the College receives the request, the College will ensure that it has contacted the individual before the deadline to explain what the College has done so far and when the College will get back to them with their Personal Data.
5.2.Right to rectification
5.2.1.If a member of the College Personnel receives a request from an individual to correct their Personal Data, the following procedure will be followed:
5.2.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.2.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.2.1.3.the College will then locate the Personal Data concerned and verify whether it is incorrect or incomplete and will correct it or complete it as soon as possible;
5.2.1.4.the College will ascertain whether the College has disclosed the incorrect Personal Data to any third parties and, if so, the College will contact those third parties as soon as possible to tell them to correct the Personal Data;
5.2.1.5.the Data Protection Officer will decide whether the College needs to keep a copy of the original Personal Data for evidence reasons or otherwise; and
5.2.1.6.the College will confirm to the individual in writing within one month of the date of their request that the College has complied with the request.
5.3.Right to erasure (right to be forgotten)
5.3.1.If a member of the College Personnel receives a request from an individual to delete their Personal Data, the following procedure will be followed:
5.3.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.3.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.3.1.3.the Data Protection Officer will reach a decision as to whether the right to be forgotten applies;
5.3.1.4.if the right to be forgotten does apply, the Data Protection Officer will decide whether the College is required to keep any parts of the Personal Data for evidence reasons and, if so, this Personal Data will be excluded from the request;
5.3.1.5.the College will then securely delete all the Personal Data about that individual that the College has which is not excluded. This will include securely shredding all hard copy documents and ensuring that computer records are securely deleted from the College’s information systems in line with the processes detailed in the College’s Data Retention Policy;
5.3.1.6.the College will ascertain whether it has disclosed the deleted Personal Data to any third parties and, if so, the College will contact those third parties as soon as possible to tell them to delete the Personal Data; and
5.3.1.7.the College will confirm to the individual in writing within one month of the date of their request that the College has complied with the request.
5.4.Right to restrict processing
5.4.1.If a member of the College Personnel receives a request from an individual to restrict the College’s use of their Personal Data, the following procedure will be followed:
5.4.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.4.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.4.1.3.the Data Protection Officer will reach a decision as to whether the right to restrict processing applies;
5.4.1.4.if the right to restrict processing does apply, the College will action the request as soon as possible and ensure that the College no longer uses the individual’s Personal Data in the way they have objected to. This may include moving documents to folders where they can no longer be accessed, removing details from files and locking paper files away;
5.4.1.5.the College will ascertain whether the College has disclosed the Personal Data to any third parties and, if so, the College will contact those third parties as soon as possible to tell them to stop using the Personal Data in the restricted way; and
5.4.1.6.the College will confirm to the individual in writing within one month of the date of their request that the College has complied with the request.
5.5.Right to data portability
5.5.1.If a member of the College Personnel receives a request from an individual to provide a copy of their Personal Data in a structured, commonly-used and machine-readable format, the following procedure will be followed:
5.5.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.5.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.5.1.3.the Data Protection Officer will reach a decision as to whether the right to data portability applies and to which subset of the individual’s Personal Data it applies; and
5.5.1.4.if the right to data portability does apply, the College will action the request as soon as possible. This will include creating an electronic copy of the individual’s Personal Data which can be transferred to another organisation if the individual asks the College to.
5.6.Right to object
5.6.1.If a member of the College Personnel receives an objection from an individual to the College’s processing of their Personal Data, the following procedure will be followed:
5.6.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.6.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.6.1.3.the Data Protection Officer will reach a decision as to whether the right to object applies;
5.6.1.4.if the right to object does apply, the College will action the request as soon as possible. This may include suppressing the individual from the College’s direct marketing lists, or stopping the processing of Personal Data that has been objected to; and
5.6.1.5.the College will write to the individual within one month of the date of their request to tell them either that the College has complied with, or intends to comply with, their request or that the College has not complied and the reasons why the College has not complied.
5.7.Rights in relation to automated decision making
5.7.1.If a member of the College Personnel receives an objection from an individual to an automated decision that the College has made about the individual which produces legal effects concerning them or similarly significantly affects them, the following procedure will be followed:
5.7.1.1.the College Personnel must forward or report the request to the Data Protection Officer or Executive Support as soon as they receive it;
5.7.1.2.the Data Protection Officer will diarise the date the request was received, the deadline to respond (ordinarily one month from the date of receipt but an extension may be possible in certain circumstances as set out in paragraph 5.9), and send weekly chasers to all College Personnel involved in dealing with the request in order to track its progress;
5.7.1.3.the Data Protection Officer will reach a decision as to whether the right to intervene in the automated decision-making applies;
5.7.1.4.if the right to intervene does apply, the College will action the request as soon as possible. This will involve reviewing the automated decision-making process, reviewing the decision that was made, having a College Personnel consider whether the decision needs to be retaken and allowing the individual to give their view on the decision; and
5.7.1.5.the College will write to the individual within one month of the date of their request to tell them what the outcome of the College’s review is.
Automated decision making happens where the College makes a decision about an individual solely by automated means without any human involvement; and
Profiling happens where the College automatically uses Personal Data to evaluate certain things about an individual.
5.8.Are there any requests the Collegedoes not have to respond to?
5.8.1.If the request the College receives from an individual is unfounded or excessive then the College may either:
5.8.1.1.refuse to action the request; or
5.8.1.2.charge a reasonable fee taking into consideration the College’s administrative costs of providing the information or taking the action requested.
5.8.2.Any decisions in relation to not actioning the request or charging a fee shall be made by the Data Protection Officer.
5.9.Response Times
5.9.1.All requests set out above must be responded to within a month unless the request is complex in which case the period may be extended up to a further two months. Any decision in relation to whether the request is complex is to be made by the Data Protection Officer who shall inform the individual making the request of the extension. Any notification of the extension to the individual shall be made within the initial one month period and shall give reasons for the delay.